home

flash_player_setup.exe

flash setup

Digital Zones

The executable flash_player_setup.exe has been detected as malware by 3 anti-virus scanners. The file has been seen being downloaded from newtest4pc.ready4newsoft.tech and multiple other hosts.
Publisher:
Digital Zones  (signed and verified)

Product:
flash setup

Version:
1.0.0.0

MD5:
383f7344c31379ec54d179c753f379c3

SHA-1:
f6d7647fe6cd0c8ffabc4fa65964a2ceee339a6f

SHA-256:
49c70f48c20f6cdfffac7f634759ee73e414c77327f3ae57c3328c3abaf3bb60

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
12/27/2024 6:46:06 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
MSIL/TrojanDownloader.Adload.AZ trojan
8.0.319.0

F-Secure
Variant.MSILPerseus.30942
5.15.21

Norman
Gen:Variant.MSILPerseus.30942
02.04.2016 17:35:19

File size:
117.4 KB (120,264 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2016

Original file name:
Flash.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flash_player_setup.exe

Digital Signature
Signed by:
Digital Zones

Authority:
COMODO CA Limited

Valid from:
3/28/2016 7:00:00 AM

Valid to:
3/29/2017 6:59:59 AM

Subject:
CN=Digital Zones, OU=Digital Zone, O=Digital Zones, STREET="ul. Akademika Koroleva, d. 9 korp. 5", L=Moscow, S=Moscow, PostalCode=129515, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
07775D7C7B8C20E915DD534EA4F8DB84

File PE Metadata
Compilation timestamp:
5/10/2016 1:57:29 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:/afoMSO6kp5hmH9RJ85h8W1cmb1Db3zTBuMZAn6F06nri:Cr6KHSJ85h8W1cmb5bPMMZ+6F06

Entry address:
0xC48E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.7257

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
41.5 KB (42,496 bytes)

The file flash_player_setup.exe has been seen being distributed by the following 9 URLs.

http://newtest4pc.ready4newsoft.tech/dl.php?dfrtge=Ygb2FQGlE4Sa2HXMWOgt97zxSeJcUP2hHU2BQsCNNcU.&cid=us5kuzsstdpi2fm2f26z&subid=2279&conversion_id=14630631087182&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=y8hvGxaSmpOlxaOhagskMnrNGBG1W_I_3asBWTH7XT4.&lpp=*-*-*

http://getupdate.ready4maintain.xyz/dl.php?gthre=ixCD18FVNFrzvqXPojRYqImzd7RCg-m6oRQWVazMq3E.&subid=VjJ8OTUwMnwzMjA5ODl8MzI1MDc0fDE0NjMyNTkyODN8MDBjYmIwZmEtZmQ5Ni00ZmMwLWNmODgtNjg5NjM4YjcxYmQwfDE4Ny4yMy42Ljl8fDV8OTgwNjQwNWFjYTBmM2M1YWI3YTY5ZWJmZmM2N2RkOTY=&conversion_id=14632593065359&app_id=4&lp_id=1526&v=tribat&stub_id=305&v_id=eBPrMZfyhy0s7dd0paxiLbP2RVm0VRGLtsAeuhsIdbM.&lpp=No match

http://24upgradecheck.install4freealways.online/dl.php?mncs=Ng4WtNxhGPEQZdqC1dWAshWscO8dCXLx14dzm1z-R-E.&cid=192721014372&sid=26518&conversion_id=14632604656758&app_id=4&lp_id=1609&v=tribat&stub_id=305&v_id=dC7duV5KuKocNU2SDkCDvYJoRpPoqxg08X3fTZyazzc.&lpp=*-*-*

http://setupupgrade12.livecheck.tech/dl.php?gthyerj=U9D0nJ7k9bUg5bGHlEzAWjLoG_fk8HErqK_2L_ETCN8.&cid=12196073081463259505&conversion_id=14632595081887&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=brXEdxI1rs3G9rIJvGnDR8vdwwRkQEuge81DnVny2Kw.&lpp=*-*-*

http://2nowup.newsoft2install.website/dl.php?dfgg=10QydW4wk10InnO0nVjw-Gm4HrFaEMU2YL_WW3YFynE.&cid=MTA1MHw1MjA3fFVTfDN8MXx8Y3pKeipTazFETVRVNE1GOWZNblJuWlc5MWNtdFFMVkJqVmxKQ1YzVTBVR0kyfHw&conversion_id=14632717157217&app_id=4&lp_id=1379&v=tribat&stub_id=305&v_id=PDXL3nHQwBtyeX7uytv_necs_TN7CVziV5js2uLDYFQ.&lpp=*-*-*

http://setupupgrade12.livecheck.tech/dl.php?gthyerj=qU3Z7XUlfImHuT1FQ4EPPqG1uIwy8JoStrTO-HH4cqA.&cid=1463258068mb09584419231&conversion_id=14632580690442&app_id=4&lp_id=1590&v=tribat&stub_id=305&v_id=bWCZHk8ntHEQfo1lNR7pXFp7_r8CH9kgBzIDHtuzCa8.&lpp=*-*-*

http://soft4update.ad4softinstall.xyz/dl.php?jhsf=cW9svrP4kFf4iVaZnnXKfv9tco7dScYb2CVdDa7QTOE.&cid=3547d0650851b530214a83058715157c-7570&sub=1995&conversion_id=14632692986869&app_id=4&lp_id=1663&v=tribat&stub_id=305&v_id=JR1E73c0jg8dwCIddGfhQY5_ueWpaBqZ0_pQ66Yt0VY.&lpp=No match

http://soft4update.ad4softinstall.xyz/dl.php?jhsf=IAnnqFQWm9tZQKvNra508noeytmAYQ862eFMMBC4QcA.&cid=6115_7436630243_Id0fa&conversion_id=14632655713469&app_id=4&lp_id=1405&v=tribat&stub_id=305&v_id=KUr6RfzSN1iwr3rVPJ2yo1WTyG2o7ADDhWMv2bQBv7s.&lpp=*-*-*

http://2nowup.newsoft2install.website/dl.php?dfgg=6UnGhEZKOlbLi5Yb-2tKcWxqzRB2bk64-58Ibcjy9mE.&cid=70937977011&subid=100696&conversion_id=14632668660760&app_id=4&lp_id=1526&v=tribat&stub_id=305&v_id=p0vZhcXx2Hbn2Lf8QBm7rRpi5OMrVl4Twc_P8X8xD-Q.&lpp=*-*-*

Remove flash_player_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.